---
title: "Test SSO claim mapping"
method: POST
path: "/v1/sso-connections/{id}/test-mapping"
tags: ["sso-connections"]
---

# Test SSO claim mapping

`POST /v1/sso-connections/{id}/test-mapping`

## Request

- Base URL: `https://api.brixsignage.com`
- URL: `https://api.brixsignage.com/v1/sso-connections/{id}/test-mapping`
- Auth: HTTP bearer

Previews the role and location a person would be granted, given a set of example identity-provider claims, by running the same mapping logic used at sign-in. This is read-only and does not sign anyone in or change anything.

## Path parameters

- `id` string, required

## Request body

- object
  - `claims` object, required: Example identity-provider claims.
  - `claimMapping` SsoClaimMapping: Rules that turn identity-provider claims into a role at a location.
    - `locationClaim` string, nullable, required: The claim whose value names a location (matched to a location's name or Location ID).
    - `rules` object[], required
      - `claim` string, required: The identity-provider claim to read, e.g. `groups`.
      - `match` 'equals' | 'contains', required
      - `value` string, required
      - `roleId` string, required: The role to grant when the rule matches.
      - `at` 'location' | 'root' | 'node', required: Where to grant it: the location named by `locationClaim`, the workspace root, or the fixed `nodeId`.
      - `nodeId` string, nullable: The location for an `at: node` rule.
    - `noMatch` 'default' | 'deny', required: When no rule matches: give `defaultRoleId` at the root, or refuse the sign-in.

## Response `200`

Success.

- object
  - `data` object, required
    - `mapped` boolean, required: False when there is no mapping: `grants` is then the default role at the root, without names.
    - `grants` object[], required
      - `nodeId` string, required: Location id (the workspace id for the root).
      - `roleId` string, required
      - `roleName` string, nullable: Absent when `mapped` is false.
      - `nodeName` string, nullable: Absent when `mapped` is false.
    - `matchedRules` integer[], required: Indexes of the rules that matched.
    - `unmatchedLocations` string[], required: Location values that matched no location.
    - `ambiguousLocations` string[], required: Location values that matched more than one location.
    - `usedDefault` boolean, required
    - `denied` boolean, required: True when the sign-in would be refused (`noMatch: deny`).

## Other responses

- `401`: Missing, expired or revoked bearer token.
- `403`: You do not hold the permission for the whole workspace (a grant at one location, or in a franchise workspace, is not enough).
- `404`: No such connection in this workspace.
- `422`: `claims` is not an object, or `claimMapping` is invalid.
- `5XX`: Server error. The body carries a `requestId` to quote to support.

---

[API](https://skmtc.dev/brixsignage/apis/brix-api.md) · [All operations](https://skmtc.dev/brixsignage/apis/brix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/brixsignage/apis/brix-api/revisions/02fd3665dc7d?raw)